General

  • Target

    NEAS.5f231da644909607af9ca4a693178fed.exe

  • Size

    450KB

  • Sample

    231028-wf4lzaed36

  • MD5

    5f231da644909607af9ca4a693178fed

  • SHA1

    853521d832333ad26e7683ce3c2218911ad08548

  • SHA256

    4e58a644b0c1d47ea2ecb375810d0c7d9cef6a2026340f1c416ea1dd9a041ec5

  • SHA512

    d1bee6c20602cc4f263d9cc47a88db123684305ecc64e081be6f2eb5ce5ef33fc8db7eb2465a3e8d74ff9d474930b63fee7fb9ad7d9c290987ca94a729d21743

  • SSDEEP

    6144:PEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpoz:PMpASIcWYx2U6hAJQnv

Score
10/10

Malware Config

Extracted

Family

urelas

C2

218.54.31.165

218.54.31.226

Targets

    • Target

      NEAS.5f231da644909607af9ca4a693178fed.exe

    • Size

      450KB

    • MD5

      5f231da644909607af9ca4a693178fed

    • SHA1

      853521d832333ad26e7683ce3c2218911ad08548

    • SHA256

      4e58a644b0c1d47ea2ecb375810d0c7d9cef6a2026340f1c416ea1dd9a041ec5

    • SHA512

      d1bee6c20602cc4f263d9cc47a88db123684305ecc64e081be6f2eb5ce5ef33fc8db7eb2465a3e8d74ff9d474930b63fee7fb9ad7d9c290987ca94a729d21743

    • SSDEEP

      6144:PEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpoz:PMpASIcWYx2U6hAJQnv

    Score
    10/10
    • Urelas

      Urelas is a trojan targeting card games.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks